Skip to content

Commit a9b630a

Browse files
MrSteve81MrSteve81
authored
Merge pull request #1 from ansible-lockdown/v2r2
Full Update To v2r2
2 parents 297e1d1 + c94466e commit a9b630a

26 files changed

+10139
-2
lines changed

‎.ansible-lint‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
3+
parseable: true
4+
quiet: true
5+
skip_list:
6+
- 'package-latest'
7+
- 'risky-shell-pipe'
8+
use_default_rules: true
9+
verbosity: 0

‎.gitattributes‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# adding github settings to show correct language
2+
*.sh linguist-detectable=true
3+
*.yml linguist-detectable=true
4+
*.ps1 linguist-detectable=true
5+
*.j2 linguist-detectable=true
6+
*.md linguist-documentation

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
3+
# This is a basic workflow to help you get started with Actions
4+
5+
name: Ansible Remediate Devel Pipeline Validation
6+
7+
# Controls when the action will run.
8+
# Triggers the workflow on push or pull request
9+
# events but only for the devel branch
10+
on: # yamllint disable-line rule:truthy
11+
pull_request_target:
12+
types: [opened, reopened, synchronize]
13+
branches:
14+
- devel
15+
paths:
16+
- '**.yml'
17+
- '**.sh'
18+
- '**.j2'
19+
- '**.ps1'
20+
- '**.cfg'
21+
22+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
23+
# This section contains all the jobs below that are running in the workflow.
24+
jobs:
25+
# This will create messages for the first time contributors and direct them to the Discord server
26+
welcome:
27+
# The type of runner that the job will run on.
28+
runs-on: ubuntu-latest
29+
steps:
30+
- uses: actions/first-interaction@main
31+
with:
32+
repo-token: ${{ secrets.GITHUB_TOKEN }}
33+
pr-message: |-
34+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
35+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
36+
37+
build-azure-windows:
38+
# Use the AWS self-hosted runner
39+
runs-on: self-hosted
40+
env:
41+
# Imported as a variable by OpenTofu.
42+
ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
43+
ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
44+
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
45+
ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
46+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
47+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
48+
OSVAR: ${{ vars.OSVAR }}
49+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
50+
TF_VAR_repository: ${{ github.event.repository.name }}
51+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
52+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
53+
54+
defaults:
55+
run:
56+
shell: bash
57+
working-directory: .github/workflows/github_windows_IaC
58+
59+
steps:
60+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
61+
- name: Clone ${{ github.event.repository.name }}
62+
uses: actions/checkout@v4
63+
with:
64+
ref: ${{ github.event.pull_request.head.sha }}
65+
66+
- name: If a variable for IAC_BRANCH is set use that branch
67+
working-directory: .github/workflows
68+
run: |
69+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
70+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
71+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
72+
else
73+
echo IAC_BRANCH=main >> $GITHUB_ENV
74+
fi
75+
76+
# Pull In OpenTofu Code For Windows Azure
77+
- name: Clone IaC Repository
78+
uses: actions/checkout@v4
79+
with:
80+
repository: ansible-lockdown/github_windows_IaC
81+
path: .github/workflows/github_windows_IaC
82+
ref: ${{ env.IAC_BRANCH }}
83+
84+
# Sensitive Data Stored And Passed To OpenTofu
85+
# Default Working Dir Defined In Defaults Above.
86+
- name: Save Sensitive Info
87+
run: echo "{\"username\":\"${WIN_USERNAME}\",\"password\":\"${WIN_PASSWORD}\"}" >> sensitive_info.json
88+
89+
# Show the Os Var and Benchmark Type And Load
90+
- name: DEBUG - Show IaC files
91+
if: env.ENABLE_DEBUG == 'true'
92+
run: |
93+
echo "OSVAR = $OSVAR"
94+
echo "benchmark_type = $benchmark_type"
95+
pwd
96+
ls
97+
env:
98+
# Imported from github variables this is used to load the relevant OS.tfvars file
99+
OSVAR: ${{ vars.OSVAR }}
100+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
101+
102+
# Initialize The OpenTofu Working Directory
103+
- name: Tofu init
104+
id: init
105+
run: tofu init
106+
env:
107+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
108+
OSVAR: ${{ vars.OSVAR }}
109+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
110+
111+
# Validate The Syntax Of OpenTofu Files
112+
- name: Tofu validate
113+
id: validate
114+
run: tofu validate
115+
env:
116+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
117+
OSVAR: ${{ vars.OSVAR }}
118+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
119+
120+
# Execute The Actions And Build Azure Server
121+
- name: Tofo Apply
122+
id: apply
123+
env:
124+
# Imported from github variables this is used to load the relevant OS.tfvars file
125+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
126+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
127+
OSVAR: ${{ vars.OSVAR }}
128+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
129+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
130+
131+
# Debug Section
132+
- name: DEBUG - Show Ansible Hostfile
133+
if: env.ENABLE_DEBUG == 'true'
134+
run: cat hosts.yml
135+
136+
# Run the Ansible Playbook
137+
- name: Run_Ansible_Playbook
138+
env:
139+
ANSIBLE_HOST_KEY_CHECKING: "false"
140+
ANSIBLE_DEPRECATION_WARNINGS: "false"
141+
run: |
142+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml ../../../site.yml
143+
144+
# Destroy The Azure Test System
145+
- name: Tofu Destroy
146+
if: always() && env.ENABLE_DEBUG == 'false'
147+
env:
148+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
149+
OSVAR: ${{ vars.OSVAR }}
150+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
151+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve

‎.github/workflows/main_pipeline_validation.yml‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
---
2+
3+
# This is a basic workflow to help you get started with Actions
4+
5+
name: Ansible Remediate Main Pipeline Validation
6+
7+
# Controls when the action will run.
8+
# Triggers the workflow on push or pull request
9+
# events but only for the devel branch
10+
on: # yamllint disable-line rule:truthy
11+
pull_request_target:
12+
types: [opened, reopened, synchronize]
13+
branches:
14+
- main
15+
- latest
16+
paths:
17+
- '**.yml'
18+
- '**.sh'
19+
- '**.j2'
20+
- '**.ps1'
21+
- '**.cfg'
22+
23+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
24+
# This section contains all the jobs below that are running in the workflow.
25+
jobs:
26+
# This workflow will run OpenTofu to load an instance in Azure to test the playbook against a live cloud-based instance.
27+
build-azure-windows:
28+
# Use the AWS self-hosted runner
29+
runs-on: self-hosted
30+
env:
31+
# Imported as a variable by OpenTofu.
32+
ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
33+
ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
34+
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
35+
ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
36+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
37+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
38+
OSVAR: ${{ vars.OSVAR }}
39+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
40+
TF_VAR_repository: ${{ github.event.repository.name }}
41+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
42+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
43+
44+
defaults:
45+
run:
46+
shell: bash
47+
working-directory: .github/workflows/github_windows_IaC
48+
49+
steps:
50+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
51+
- name: Clone ${{ github.event.repository.name }}
52+
uses: actions/checkout@v4
53+
with:
54+
ref: ${{ github.event.pull_request.head.sha }}
55+
56+
- name: If a variable for IAC_BRANCH is set use that branch
57+
working-directory: .github/workflows
58+
run: |
59+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
60+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
61+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
62+
else
63+
echo IAC_BRANCH=main >> $GITHUB_ENV
64+
fi
65+
66+
# Pull In OpenTofu Code For Windows Azure
67+
- name: Clone IaC Repository
68+
uses: actions/checkout@v4
69+
with:
70+
repository: ansible-lockdown/github_windows_IaC
71+
path: .github/workflows/github_windows_IaC
72+
ref: ${{ env.IAC_BRANCH }}
73+
74+
# Sensitive Data Stored And Passed To OpenTofu
75+
# Default Working Dir Defined In Defaults Above.
76+
- name: Save Sensitive Info
77+
run: echo "{\"username\":\"${WIN_USERNAME}\",\"password\":\"${WIN_PASSWORD}\"}" >> sensitive_info.json
78+
79+
# Show the Os Var and Benchmark Type And Load
80+
- name: DEBUG - Show IaC files
81+
if: env.ENABLE_DEBUG == 'true'
82+
run: |
83+
echo "OSVAR = $OSVAR"
84+
echo "benchmark_type = $benchmark_type"
85+
pwd
86+
ls
87+
env:
88+
# Imported from github variables this is used to load the relevant OS.tfvars file
89+
OSVAR: ${{ vars.OSVAR }}
90+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
91+
92+
# Initialize The OpenTofu Working Directory
93+
- name: Tofu init
94+
id: init
95+
run: tofu init
96+
env:
97+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
98+
OSVAR: ${{ vars.OSVAR }}
99+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
100+
101+
# Validate The Syntax Of OpenTofu Files
102+
- name: Tofu validate
103+
id: validate
104+
run: tofu validate
105+
env:
106+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
107+
OSVAR: ${{ vars.OSVAR }}
108+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
109+
110+
# Execute The Actions And Build Azure Server
111+
- name: Tofo Apply
112+
id: apply
113+
env:
114+
# Imported from github variables this is used to load the relevant OS.tfvars file
115+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
116+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
117+
OSVAR: ${{ vars.OSVAR }}
118+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
119+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
120+
121+
# Debug Section
122+
- name: DEBUG - Show Ansible Hostfile
123+
if: env.ENABLE_DEBUG == 'true'
124+
run: cat hosts.yml
125+
126+
# Run the Ansible Playbook
127+
- name: Run_Ansible_Playbook
128+
env:
129+
ANSIBLE_HOST_KEY_CHECKING: "false"
130+
ANSIBLE_DEPRECATION_WARNINGS: "false"
131+
run: |
132+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml ../../../site.yml
133+
134+
# Destroy The Azure Test System
135+
- name: Tofu Destroy
136+
if: always() && env.ENABLE_DEBUG == 'false'
137+
env:
138+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
139+
OSVAR: ${{ vars.OSVAR }}
140+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
141+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve

‎.github/workflows/update_galaxy.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# This is a basic workflow to help you get started with Actions
2+
3+
name: Update Galaxy
4+
5+
# Controls when the action will run.
6+
# Triggers the workflow on push or pull request
7+
# events but only for the devel branch
8+
on:
9+
push:
10+
branches:
11+
- main
12+
13+
jobs:
14+
update_role:
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Checkout V4
19+
uses: actions/checkout@v4
20+
21+
- name: Update Galaxy
22+
uses: ansible-actions/ansible-galaxy-action@main
23+
with:
24+
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
25+
git_branch: main

‎.gitignore‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
.env
2+
*.log
3+
*.retry
4+
.vagrant
5+
tests/*redhat-subscription
6+
tests/Dockerfile
7+
*.iso
8+
*.box
9+
packer_cache
10+
delete*
11+
ignore*
12+
# VSCode
13+
.vscode
14+
vagrant
15+
16+
# Byte-compiled / optimized / DLL files
17+
__pycache__/
18+
*.py[cod]
19+
*$py.class
20+
21+
# DS_Store
22+
.DS_Store
23+
._*
24+
25+
# Linux Editors
26+
*~
27+
\#*\#
28+
/.emacs.desktop
29+
/.emacs.desktop.lock
30+
.elc
31+
auto-save-list
32+
tramp
33+
.\#*
34+
*.swp
35+
*.swo
36+
rh-creds.env
37+
travis.env
38+
39+
# Lockdown-specific
40+
benchparse/
41+
*xccdf.xml
42+
*.retry
43+
44+
# GitHub Action/Workflow files
45+
.github/
46+
.github/.ansible/.lock
47+
.ansible/

0 commit comments

Comments
 (0)